- Test - lists.nanog.org

Network reliability and security
by Sean Donelan 27 Oct '00

27 Oct '00

My first trip to Washington DC in almost a year, and things are as weird as ever. One topic which kept coming up Internet security, and the possibility of someone with hostile intent disrupting the Internet. My theory and experience is these attacks, while devastating to individual networks and sites, have extremely localized affect. If you are just a few networks removed, you don't see much collateral affects. Now some folks are pointing to the current "cyber-war" going on in the Middle East as evidence great plans must be made. I poked around a bit, and yes, some sites and networks have severe problems. But it had essentially no affect on Internet performance outside the immediate area. What are network operators experiencing?

1 0

Re: Service Provider Exchange requirements
by Simon Leinen 26 Oct '00

26 Oct '00

>>>>> "jf" == John Fraizer <nanog(a)EnterZone.Net> writes: > If your switch is MCAST aware, you should be able to keep mcast > traffic on ports tagged for it to begin with. Is the idea that you can statically configure which of the IXP switch's ports should be multicast-capable at all? This would cause administrative overhead and would still not solve the problem of multicast-capable routers that receive copies of multicast traffic they aren't currently interested in. > If your switch isn't mcast aware. you need to find a new switch. It is actually quite hard for switches to be "mcast aware" enough to copy multicast packets to exactly the set of who are interested in them. They either have to listen to and understand the multicast routing-protocol-of-the-day, or there must be some explicit protocol between multicast routers and the switch. In any case this is much more difficult than what most "multicast aware" switches currently do, i.e. IGMP snooping (which helps for end-systems, not routers, connected to the switch). -- Simon.

1 0

Beta-testers needed (if not interested please delete now)
by Hugh Irvine 26 Oct '00

26 Oct '00

I am looking for beta-testers for some new software called Nets. (From Open System Consultants, authors of Radiator - the ISP Radius server that many of you will be familiar with.) Nets is an Open Source network inventory and management system, with a graphical user interface that runs on any Unix or Microsoft Windows system and almost any free or commercial SQL database as the back end. If you are interested, please have a look at http://www.open.com.au/nets and contact me directly. Many thanks Hugh Irvine hugh(a)open.com.au

1 0

Route Registry: who uses them?
by Todd Caine 25 Oct '00

25 Oct '00

I've been talking with our router geeks and we have been debating over the usefulness of route registries. We were asked recently on an application for peering if we consult RADB, and our response was, "We have used it although it's not up to date; Why do you use it?", and we received no response. In my experience, I've never heard of any cases where it has been used. Who should use Route Registries? Why? Is it worth the time? Do people trust that the information is accurate enough to let a route server automate establishing your peering sessions? Is there a limit to the detail that you should provide? I've looked at some of the information that other providers have put in the route registry, but nothing really seemed all that useful to us. Would anyone agree or disagree? Am I missing something here? Regards, Todd Caine /* * Todd Caine * (360) 816-4344 * tcaine(a)eli.net */

4 3

Re: Cheapest ethernet switch with monitor/mirror port?
by Dan Hollis 25 Oct '00

25 Oct '00

On Wed, 25 Oct 2000, barry reginaldo wrote: > Why don't you try the Cisco Catalyst 2912XL-EN switch. > It has 12 ports 10/100 priced at $1495 list. An even cheaper alternative is the Cisco Catalyst 1912-A swich. It has 12 port 10Mbps and 2 100Mbps priced a $895 list. Ive found a better solution. An $80 8-port 10/100 desktop switch, and Ill sniff the 100bt uplink. -Dan

2 1

[Somewhat OT] ATM Port/Class of Service Pricing
by Allan Carscaddon 25 Oct '00

25 Oct '00

I just had some materials dropped off on my desk to verify with regards to ATM pricing. I am, unfortunately, not as current on ATM service pricing as I would need to be to verify the prices that I have. I don't know very well where to begin and I hope that someone here can a) help, or b) point me to someone who could. I have some prices for ATM service based on port speed (e.g., ATM ports from an IXC), at a customer site for various speeds (DS3, OC3, etc). I also have some additional prices based on Class of Service (CBR, UBR, and VBR) and by the amount of "committed data rate" (PCR in the case of CBR traffic and SCR in the case of VBR traffic). If anyone out there is willing to share information that they have on ATM pricing, I would very much appreciate their sharing with me. If interest warrants, I will summarize to the group (pending permission from those providing information). Best regards, and thanks in advance, Allan

1 0

whois breakage
by Joshua Goodall 25 Oct '00

25 Oct '00

$ whois -h whois.internic.net microsoft.com Whois Server Version 1.3 Domain names in the .com, .net, and .org domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET MICROSOFT.COM Enough said. Similar for apple.com. The web-based whois client at nsiregistry.com is giving correct results, as are the gtld-servers, as does -h networksolutions.com FreeBSD and at least one release of Linux I've tested query whois.internic.net by default. If anyone is using automated whois in production (very likely), check your results! J

3 2

RE: whois
by Karyn Ulriksen 25 Oct '00

25 Oct '00

You're kidding, right? -K > -----Original Message----- > From: bmanning(a)vacation.karoshi.com > [mailto:bmanning@vacation.karoshi.com] > Sent: Tuesday, October 24, 2000 7:23 AM > To: tme(a)21rst-century.com > Cc: nanog(a)nanog.org > Subject: Re: whois > > > > Yow! A chance to play devils advocate... Cool :) > > If you told me a dialup user on my network did anything, I'd doubt > your veracity. How do you know I have dialup services in my network? > The accuracy of your clock and the recorded IP address > are suspect since I have zero visability into your network structure > or administrative practice... and you don't have that visability into > mine. Your clock is hacked and you are forging IP addresses > in an attempt > to distract me from providing services. Tell me why this is > not a simple > case of harassment? Full and public disclosure of the attack > profile would > help build your credibility. And yes, if I have no business > relationship > to you and I've never had a relationship with you and you are making > assertions about my infrastructure and clients, I will prolly want > some incentive to cover the costs of investigating your outragous > claims. > > > > Are you really saying that if I tell you that a dial-up > user on your network > > hacked into my system at some precise time, from a precise > IP address > > (so that you could probably tell easily which user did it), > and did so > > in a fashion > > which suggested an automated "script kiddie" effort, I should only > > expect a response from you if I PAY for it ?!? > > > > This seems pretty close to the "protection" money that I > hear people with > > POP's in Moscow have to pay :) > > > > (BTW, I said nothing about timeliness > > or 24x7 availability - a note a week or two later would > have sufficed.) > > > > > > > > > > > > The key to an anti-hacker ISP association would be > > > > > a very special ip address / contact person lookup database. > > > > > ie: who/how to contact for the 'SWAT' response for a > particular IP > > > > > address. > > > > > > > > > > --Mike-- > > > > > > > > Hello; > > > > > > > > When we have had attacks such as root exploits, we have > notified the > > > > source (at least, > > > > the ISP hosting the immediate source) as to the date, > time, IP address, etc. > > > > (In one case, the attack appeared to come from a > dial-up address in Germany, > > > > so I thought we had them.) We have NEVER received a > response. From > > > > conversations at meetings, etc., I understand that this > is typical - almost > > > > universal - and that it would be naive to expect other > ISPs to actually > > > > do anything > > > > about being a source for attacks. > > > > > > > > Maybe a start would be to a BCP for some level of > minimal response if > > > > you source > > > > an attack, and a "web site of shame" listing those > domains that source > > > > attacks and do nothing about it when notified. > > > > > > > > > > -- > > > > > > Regards > > Marshall Eubanks > > > > > > Multicast Technologies, Inc. > > 10301 Democracy Lane, Suite 201 > > Fairfax, Virginia 22030 > > Phone : 703-293-9624 Fax : 703-293-9609 > > e-mail : tme(a)on-the-i.com http://www.on-the-i.com > > > >

2 1

Re: whois breakage
by Joshua Goodall 24 Oct '00

24 Oct '00

Spoof, noun, A humorous parody. I wasn't referring to spoofing (generically, forging data) Perhaps I should try to end this thread, having (hopefully) made my point, which is presumably the same point that "terrorists.net" wanted to make, about how the registry search should and should not behave. J On Tue, 24 Oct 2000, Matthew S. Hallacy wrote: > It's not a 'spoofed' entry, it's a nameserver entry. > > > -poptix > > On Tue, 24 Oct 2000, Joshua Goodall wrote: > > > > > > > I would contend that it *is* broken, because it doesn't DWIM (I can see > > people pouting already), and that there should be an implied $ on the end > > of any search-string, since dns become more specific to the left. > > > > I don't see an argument in favour of free-form searches in this database. > > Spoof entries like these, however, are an argument against them. > > > > J > > >

1 0

Re: Cheapest ethernet switch with monitor/mirror port?
by Henry Yen 24 Oct '00

24 Oct '00

On Mon, Oct 23, 2000 at 10:25:26AM -0400, Stewart MacLund wrote: > > www.datacommwarehouse.com lists the 3548 with enterprise s/w at $3,630US. > > a 16-port 460t lists for $830US. a 24-port 460t lists for $1110US. > > cheaper out of the box as well as cheaper per port, or did i miss something? > My apologies. I was actually looking at an Intel 510T switch, not the 460T. > The 510T is a stackable switch. The 3548 ran me 5385cdn, and the 510T was 2276. > Since the 3548 is 48 ports, it's 111.63cdn a port. The 510T was 94.83 a port. > Oh. Hm. Odd. Why the hell did i go with the Cisco? Oh, i remember. The Intel > was a 4 week delivery thing, whilst the 3548 was immediate. And i'm Cisco biased. > :) and the 460t/16 would be about 77cdn per port. i tend to be cisco-biased when it comed to routers (or, perhaps it's more accurate to say i'm biased _against_ most of cisco's router competitors...). on the other hand, when we're talking LAN instead of WAN (for small stuff, anyway), i'm of the opinion that the cisco line-up is much too expensive (and i don't need that much handholding for a lan switch, and i've already got cco for my router contracts anyway), and a bunch of it is getting long in the tooth. > Looking at my competetive price quote, i was also looking at Nortel Baystack > 450-24T ENET Switch for 2618cdn, a 3COM Superstack II Switch 3900 - 36 Port for > 4429cdn, and some variations for ports on the cisco and 3com products. we've had bad experiences with baytel lan stuff, and who knows what direction 3com is going in now-a-days (mid-range LAN doesn't seem to be it, though). > > it appears allied telesyn has a 24-port fully managed switch for $740 > > (AT-8126XL-10), as well as a 16-port model (AT-8118), and although > > i'd be surprised if port monitoring weren't a feature, the a-t website > > doesn't seem to specifically mention it. > Hm. Buyer beware. Check to make sure. Frankly, i have nothing but good > things to say abou the 3548. It's very robust, stacks well, and monitoring is a > snap. Mine run CiscoIOS 12.0, which has every feature i'd ever want. You could > check to see what the non-enterprise-load-of-the-software version runs for. I'm > sure it's cheaper. There was a specific reason i wanted the enterprise load on > mine, but being monday morning, my brain is not quite in gear yet. (Hence the > train of thought being typed in earlier) ios12 is a good thing for cisco routers, agreed. they finally folded in nat without requiring the firewall or enterprise feature set. but the original poster seemed to be looking for a cheapie (although reliable, i assume, or why post the question on nanog, after all...) switch that he could snarf a monitor port from, and not a general recommendation for that capability for a mid-range or high-end switch. i think once you get down to the $800 or so range (1200cdn), there's not going to be much difference in what you get. -- Henry Yen Aegis Information Systems, Inc. Senior Systems Programmer Hicksville, New York

5 6